He described a local password (basically a passphrase) on the "The user's view of the application" page[1].

[1] https://www.grc.com/sqrl/userview.htm